Welcome to Splunk Answers, a Q&A forum for users to find answers to questions about deploying, managing, and using Splunk products. Contributors of all backgrounds and levels of expertise come here to find solutions to their issues, and to help other users in the Splunk community with their own questions.

This quick tutorial will help you get started with key features to help you find the answers you need. You will receive 10 karma points upon successful completion!

Refine your search:

How is frozenTimePeriodInSecs applied?

0

Is this applied (or can it be applied) on an index-by-index basis, or does it apply to everything on the indexer? For example, I have one index containing data of a type that I want to freeze after 90 days (7776000 seconds), but another index containing data that I want to keep for as long as possible (for now, 188697600 seconds).

Can I simply add frozenTimePeriodInSecs in indexes.conf to the index I want to truncate earlier and not to the second one (or add it to the second one with the default number of seconds applied)?